Precedent-setting privacy breach sentence must be significant: Ring

A fine of $1,000 to the former hospital clerk who inappropriately accessed patient records would upset the province's information and privacy commissioner.

Ed Ring made the comment with respect the defence's submission at the facts and sentencing hearing for Donna Colbourne Tuesday in provincial court in Corner Brook. Ring attended the hearing of the first conviction under the provincial Personal Health Information Act.

"The quick answer is I would be very disappointed personally," he said, when asked about the submission of defence lawyer James Goodwin.

Colbourne pleaded guilty to inappropriately accessing 1,043 patient files between June 2011 and May 2012 while employed at Western Memorial Regional Hospital. Through an audit it was discovered she accessed files through the Meditech system that did not have a connection to her job description and duties. There were 75 instances of inappropriate access.

Her access was limited to information about date and the billing code for each patient visit. In some cases, the billing code for the visit contained sensitive personal health information - specifically the reason for the visit. She had full access to patient names, addresses. billing information, date of birth, MCP number, next of kin, emergency contact information and marital status.

Previous incidents of similar breaches - of which there have been seven or eight in the province, according to Ring - have resulted in employees reinstated. He is looking for a sentence of far more consequence this time.

Ring said a message should be sent showing personal information has to be protected and the consequences severe. “… That we are prepared to go to court and provide that extra hurdle so that someone thinking about inappropriately accessing information will say, ‘Right, I may have to face the judge.’"

In his sentencing submission, Khaladkar told the court the sentencing of Colbourne is more important to send a message to the public than to Colbourne herself. That fact was also reiterated by Ring outside the courtroom afterwards.

Health care professionals must be trusted with personal and medical information that is often essential to the care and treatment of patients, Khaladkar said. A breach such as the one made by Colbourne has a devastating impact on the victims and creates a lack of trust within people in general. This can lead to the withholding of pertinent personal information, he submitted.

The identity of the more than 1,000 victims of the breach is protected by a court-ordered publication ban. However, the Crown attorney read a victim impact statement from one of those victims. She said she was "devastated" to learn her personal and medical information was accessed inappropriately. It has created much stress and leaves an ongoing element of uncertainty in her life.

It also creates a victim of Western Health. The organization had to conduct audits, investigations, and other human resource processes as well as contact every person whose privacy was breached, report to the privacy commissioner's office, and participate in the prosecution. The trustworthiness of the organization itself is also called into question, according to Khaladkar.

The Crown attorney said the sentence for the first conviction under the provincial Personal Health Information Act must be significant enough to deter any other health care professional from considering doing this in the future. Since Colbourne was fired and no longer has access to such information, general deterrence becomes the biggest principal of sentencing, he submitted.

Goodwin countered that the ramifications have already been severe for Colbourne. She was fired from her job and the subject of significant media attention as a result of her crime. He stressed that there was no evidence the information accessed was distributed to anybody else.

With limited resources to assist in sentencing - Khaladkar said there is only two similar cases in Canada, both in Alberta. Howe decided to take some time to deliver the precedent-setting decision. She referred to the case as a "new area" for the court. Her decision is scheduled for Sept. 11.

Your comment has been submitted. It will be moderated prior to its display.